<div dir="ltr">NIH requires (among other things) FIPS certified encryption on data-at-rest for any NIH funded grant/research project. Our DC is secure, but it would be technically possible for another admin to potentially gain access to the rack and our server drives. This adds another layer of security. Maybe overkill? In any case, it's becoming policy for many agencies. </div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 8, 2014 at 1:12 PM, Jim Kinney <span dir="ltr"><<a href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Added layer of physical security for HIPAA compliance led to the wholesale<br>
adoption. Yes, remote access and data theft would occur to a decrypted<br>
filesystem once it's running. But much of my work often requires encrypted<br>
data at rest for many system and the performance hit is essentially trivial<br>
compared to the rest of the system, so it's easy to to keep that as a<br>
default. The HPC systems have absolutely all security disabled and are<br>
hidden behind firewalls on private LAN, etc.<br>
<br>
It also indicates a level of unsure trust of the physical access to the<br>
systems. Never had an issue but don't want to be on the wrong end if<br>
something does happen.<br>
<div><div class="h5"><br>
On Mon, Sep 8, 2014 at 12:54 PM, Beddingfield, Allen <<a href="mailto:allen@ua.edu">allen@ua.edu</a>> wrote:<br>
<br>
> I'm curious about why you would encrypt filesystems on servers, if you<br>
> have control of physical access? If the server is up and online, the<br>
> drives would be decrypted, and the files would be accessible by any remote<br>
> exploit. I'm sure I'm missing a good reason for it, but I haven't had<br>
> enough caffeine to fully get the brain cranked up today :D<br>
> --<br>
> Allen Beddingfield<br>
> Systems Engineer<br>
> The University of Alabama<br>
><br>
> ________________________________________<br>
> From: <a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a> [<a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a>] on behalf of Jim Kinney [<br>
> <a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>]<br>
> Sent: Monday, September 08, 2014 11:46 AM<br>
> To: Atlanta Linux Enthusiasts<br>
> Subject: Re: [ale] OT - SED drive compatibility<br>
><br>
> Using LUKS software encryption on a system with 15k RPM drives will be a<br>
> minimal hit on performance as long as there is adequate RAM and cores to do<br>
> the decryption. A single core is enough and the RAM needs are actually<br>
> small. A few blocks at a time are fed through for decrypt then passed to<br>
> buffers for use.<br>
><br>
> I use LUKS on EVERY public facing (and many internal only systems) server.<br>
> The only big caveat is the need to have remote console so the password can<br>
> be entered for key decryption after a reboot.<br>
><br>
><br>
> _______________________________________________<br>
> Ale mailing list<br>
> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
><br>
<br>
<br>
<br>
</div></div><span class="">--<br>
--<br>
James P. Kinney III<br>
<br>
Every time you stop a school, you will have to build a jail. What you gain<br>
at one end you lose at the other. It's like feeding a dog on his own tail.<br>
It won't fatten the dog.<br>
- Speech 11/23/1900 Mark Twain<br>
<br>
<br>
*<a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br>
<<a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a>>*<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</span>URL: <<a href="http://mail.ale.org/pipermail/ale/attachments/20140908/45281a05/attachment.html" target="_blank">http://mail.ale.org/pipermail/ale/attachments/20140908/45281a05/attachment.html</a>><br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</div></div></blockquote></div><br></div>